@kensio/yulin 0.32.0 → 0.33.0

package/dist/service/sts/auth-z/assume-role-trust-policy-authorizer.d.ts

@@ -0,0 +1,45 @@
+import type { SimAwsPrincipal } from "../../aws/caller/sim-aws-caller.js";
+import type { SimGetRoleCommandOutput } from "../../iam/command/role/get-role/get-role.cmd.js";
+import type { SimIamConditionValue } from "../../iam/policy/sim-iam-policy.js";
+import type { SimIam } from "../../iam/sim-iam.js";
+import type { SimIamPolicyDecision } from "../../iam/authorize/sim-iam-decision.js";
+type AssumeRoleTargetRole = SimGetRoleCommandOutput["Role"];
+interface AssumeRoleTrustPolicyAuthorizationInput {
+    readonly roleArn: string;
+    readonly role: AssumeRoleTargetRole;
+    readonly targetIam: SimIam;
+    readonly caller: SimAwsPrincipal;
+    readonly conditionContext?: Readonly<Record<string, SimIamConditionValue>> | undefined;
+}
+export interface AssumeRoleTrustPolicyAuthorization {
+    readonly decision: SimIamPolicyDecision;
+    readonly isDirectPrincipalGrant: boolean;
+}
+/**
+ * Evaluates an AssumeRole request against a target Role's trust policy.
+ *
+ * Trust policies are resource policies attached to IAM Roles. An AssumeRole
+ * request succeeds only when the policy evaluation produces a trust-policy Allow
+ * and does not produce an explicit Deny.
+ *
+ * Keeping this evaluation separate from target resolution and Role loading makes
+ * the authorization boundary easier to maintain. This class receives an already
+ * loaded Role and the IAM facade for its account, then owns all processing of the
+ * Role's AssumeRolePolicyDocument.
+ */
+export declare class AssumeRoleTrustPolicyAuthorizer {
+    private readonly trustGrantClassifier;
+    /**
+     * Require the target Role's trust policy to allow the supplied caller.
+     *
+     * IAM stores AssumeRolePolicyDocument as JSON text. The document is parsed here,
+     * after checking that it exists, because policy evaluation requires a structured
+     * policy document.
+     *
+     * An explicit Deny always rejects the request. The request is also rejected when
+     * no trust-policy statement grants access, even if no explicit Deny matched.
+     */
+    authorize(input: AssumeRoleTrustPolicyAuthorizationInput): AssumeRoleTrustPolicyAuthorization;
+}
+export {};
+//# sourceMappingURL=assume-role-trust-policy-authorizer.d.ts.map

package/dist/service/sts/auth-z/assume-role-trust-policy-authorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assume-role-trust-policy-authorizer.d.ts","sourceRoot":"","sources":["../../../../src/service/sts/auth-z/assume-role-trust-policy-authorizer.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iDAAiD,CAAC;AAE/F,OAAO,KAAK,EACV,oBAAoB,EAErB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AAGpF,KAAK,oBAAoB,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;AAE5D,UAAU,uCAAuC;IAC/C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IACpC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC,QAAQ,CAAC,gBAAgB,CAAC,EACxB,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,GAAG,SAAS,CAAC;CAC9D;AAED,MAAM,WAAW,kCAAkC;IACjD,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC;IACxC,QAAQ,CAAC,sBAAsB,EAAE,OAAO,CAAC;CAC1C;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,+BAA+B;IAC1C,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAwC;IAE7E;;;;;;;;;OASG;IACH,SAAS,CACP,KAAK,EAAE,uCAAuC,GAC7C,kCAAkC,CA0CpC;CACF"}

package/dist/service/sts/auth-z/assume-role-trust-policy-authorizer.js

@@ -0,0 +1,64 @@
+import { jsonParse } from "../../../util/type-guard/json.js";
+import { SimIamAccessDenied } from "../../iam/error/sim-iam.error.js";
+import { AssumeRoleTrustGrantClassifier } from "./assume-role-trust-grant-classifier.js";
+/**
+ * Evaluates an AssumeRole request against a target Role's trust policy.
+ *
+ * Trust policies are resource policies attached to IAM Roles. An AssumeRole
+ * request succeeds only when the policy evaluation produces a trust-policy Allow
+ * and does not produce an explicit Deny.
+ *
+ * Keeping this evaluation separate from target resolution and Role loading makes
+ * the authorization boundary easier to maintain. This class receives an already
+ * loaded Role and the IAM facade for its account, then owns all processing of the
+ * Role's AssumeRolePolicyDocument.
+ */
+export class AssumeRoleTrustPolicyAuthorizer {
+    trustGrantClassifier = new AssumeRoleTrustGrantClassifier();
+    /**
+     * Require the target Role's trust policy to allow the supplied caller.
+     *
+     * IAM stores AssumeRolePolicyDocument as JSON text. The document is parsed here,
+     * after checking that it exists, because policy evaluation requires a structured
+     * policy document.
+     *
+     * An explicit Deny always rejects the request. The request is also rejected when
+     * no trust-policy statement grants access, even if no explicit Deny matched.
+     */
+    authorize(input) {
+        if (input.role.AssumeRolePolicyDocument === undefined) {
+            throw new SimIamAccessDenied({
+                principal: input.caller,
+                action: "sts:AssumeRole",
+                resource: input.roleArn,
+            });
+        }
+        const trustPolicy = jsonParse(input.role.AssumeRolePolicyDocument);
+        const decision = input.targetIam.authorize({
+            action: "sts:AssumeRole",
+            resource: input.roleArn,
+            caller: input.caller,
+            conditionContext: input.conditionContext,
+            resourcePolicies: [
+                {
+                    sourceType: "trust",
+                    policyName: "AssumeRolePolicyDocument",
+                    resourceArn: input.roleArn,
+                    document: trustPolicy,
+                },
+            ],
+        });
+        if (decision.isDenied || !decision.isAllowedByTrustPolicy) {
+            throw new SimIamAccessDenied({
+                principal: input.caller,
+                action: "sts:AssumeRole",
+                resource: input.roleArn,
+            });
+        }
+        return {
+            decision,
+            isDirectPrincipalGrant: this.trustGrantClassifier.hasDirectPrincipalGrant(decision.trustAllowStatements),
+        };
+    }
+}
+//# sourceMappingURL=assume-role-trust-policy-authorizer.js.map

package/dist/service/sts/auth-z/assume-role-trust-policy-authorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"assume-role-trust-policy-authorizer.js","sourceRoot":"","sources":["../../../../src/service/sts/auth-z/assume-role-trust-policy-authorizer.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAG7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAOtE,OAAO,EAAE,8BAA8B,EAAE,MAAM,yCAAyC,CAAC;AAkBzF;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,+BAA+B;IACzB,oBAAoB,GAAG,IAAI,8BAA8B,EAAE,CAAC;IAE7E;;;;;;;;;OASG;IACH,SAAS,CACP,KAA8C;QAE9C,IAAI,KAAK,CAAC,IAAI,CAAC,wBAAwB,KAAK,SAAS,EAAE,CAAC;YACtD,MAAM,IAAI,kBAAkB,CAAC;gBAC3B,SAAS,EAAE,KAAK,CAAC,MAAM;gBACvB,MAAM,EAAE,gBAAgB;gBACxB,QAAQ,EAAE,KAAK,CAAC,OAAO;aACxB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,WAAW,GAAG,SAAS,CAC3B,KAAK,CAAC,IAAI,CAAC,wBAA4D,CACxE,CAAC;QAEF,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC;YACzC,MAAM,EAAE,gBAAgB;YACxB,QAAQ,EAAE,KAAK,CAAC,OAAO;YACvB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,gBAAgB,EAAE;gBAChB;oBACE,UAAU,EAAE,OAAO;oBACnB,UAAU,EAAE,0BAA0B;oBACtC,WAAW,EAAE,KAAK,CAAC,OAAO;oBAC1B,QAAQ,EAAE,WAAW;iBACtB;aACF;SACF,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,sBAAsB,EAAE,CAAC;YAC1D,MAAM,IAAI,kBAAkB,CAAC;gBAC3B,SAAS,EAAE,KAAK,CAAC,MAAM;gBACvB,MAAM,EAAE,gBAAgB;gBACxB,QAAQ,EAAE,KAAK,CAAC,OAAO;aACxB,CAAC,CAAC;QACL,CAAC;QAED,OAAO;YACL,QAAQ;YACR,sBAAsB,EAAE,IAAI,CAAC,oBAAoB,CAAC,uBAAuB,CACvE,QAAQ,CAAC,oBAAoB,CAC9B;SACF,CAAC;IACJ,CAAC;CACF"}

package/dist/service/sts/auth-z/resolve/assume-role-target-resolver.d.ts

@@ -0,0 +1,44 @@
+import type { SimAwsAccountId } from "../../../aws/sim-aws-account.js";
+import { IamRoleArnParser, type IamRoleArnParts } from "../../../iam/role/arn/sim-iam-role-arn-parser.js";
+/**
+ * Resolves and validates the target identity used by an AssumeRole request.
+ *
+ * STS callers can identify the target in either of two forms:
+ *
+ * - an Account ID, with the Role name obtained from the Role ARN;
+ * - parsed Role ARN parts containing both the Account ID and Role name.
+ *
+ * The Role ARN remains the canonical source because it is the resource that IAM
+ * authorizes. The separately supplied target is checked against that ARN so STS
+ * cannot resolve one Role while authorizing another resource.
+ */
+export declare class AssumeRoleTargetResolver {
+    private readonly roleArnParser;
+    constructor(roleArnParser?: IamRoleArnParser);
+    /**
+     * Parse the Role ARN and verify that it agrees with the supplied target.
+     *
+     * An Account ID target only constrains the account. This form is used when the
+     * caller has not already parsed the Role name, so the returned name comes from
+     * the ARN.
+     *
+     * A parsed target constrains both the account and Role name. Both values must
+     * match before the target can be used for IAM lookup.
+     */
+    resolve(roleArn: string, target: IamRoleArnParts | SimAwsAccountId): IamRoleArnParts;
+    /**
+     * Require an Account ID target to identify the account encoded in the ARN.
+     *
+     * Returning the parsed ARN parts after this check supplies the Role name while
+     * preserving the existing Account-ID-only input form.
+     */
+    private requireMatchingAccount;
+    /**
+     * Require pre-parsed target parts to represent the same Role as the ARN.
+     *
+     * Comparing both fields prevents a target from selecting a different account
+     * or a different Role in the same account.
+     */
+    private requireMatchingRole;
+}
+//# sourceMappingURL=assume-role-target-resolver.d.ts.map

package/dist/service/sts/auth-z/resolve/assume-role-target-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assume-role-target-resolver.d.ts","sourceRoot":"","sources":["../../../../../src/service/sts/auth-z/resolve/assume-role-target-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AACvE,OAAO,EACL,gBAAgB,EAChB,KAAK,eAAe,EACrB,MAAM,kDAAkD,CAAC;AAE1D;;;;;;;;;;;GAWG;AACH,qBAAa,wBAAwB;IACvB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAA1C,YAA6B,aAAa,mBAAyB,EAAI;IAEvE;;;;;;;;;OASG;IACH,OAAO,CACL,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,eAAe,GAAG,eAAe,GACxC,eAAe,CAUjB;IAED;;;;;OAKG;IACH,OAAO,CAAC,sBAAsB;IAY9B;;;;;OAKG;IACH,OAAO,CAAC,mBAAmB;CAY5B"}

package/dist/service/sts/auth-z/resolve/assume-role-target-resolver.js

@@ -0,0 +1,62 @@
+import { IamRoleArnParser, } from "../../../iam/role/arn/sim-iam-role-arn-parser.js";
+/**
+ * Resolves and validates the target identity used by an AssumeRole request.
+ *
+ * STS callers can identify the target in either of two forms:
+ *
+ * - an Account ID, with the Role name obtained from the Role ARN;
+ * - parsed Role ARN parts containing both the Account ID and Role name.
+ *
+ * The Role ARN remains the canonical source because it is the resource that IAM
+ * authorizes. The separately supplied target is checked against that ARN so STS
+ * cannot resolve one Role while authorizing another resource.
+ */
+export class AssumeRoleTargetResolver {
+    roleArnParser;
+    constructor(roleArnParser = new IamRoleArnParser()) {
+        this.roleArnParser = roleArnParser;
+    }
+    /**
+     * Parse the Role ARN and verify that it agrees with the supplied target.
+     *
+     * An Account ID target only constrains the account. This form is used when the
+     * caller has not already parsed the Role name, so the returned name comes from
+     * the ARN.
+     *
+     * A parsed target constrains both the account and Role name. Both values must
+     * match before the target can be used for IAM lookup.
+     */
+    resolve(roleArn, target) {
+        const parsedRoleArn = this.roleArnParser.parse(roleArn);
+        if (typeof target === "string") {
+            this.requireMatchingAccount(roleArn, target, parsedRoleArn);
+            return parsedRoleArn;
+        }
+        this.requireMatchingRole(roleArn, target, parsedRoleArn);
+        return target;
+    }
+    /**
+     * Require an Account ID target to identify the account encoded in the ARN.
+     *
+     * Returning the parsed ARN parts after this check supplies the Role name while
+     * preserving the existing Account-ID-only input form.
+     */
+    requireMatchingAccount(roleArn, targetAccountId, parsedRoleArn) {
+        if (parsedRoleArn.accountId !== targetAccountId) {
+            throw new Error(`Target Account ${targetAccountId} does not match Role ARN ${roleArn}`);
+        }
+    }
+    /**
+     * Require pre-parsed target parts to represent the same Role as the ARN.
+     *
+     * Comparing both fields prevents a target from selecting a different account
+     * or a different Role in the same account.
+     */
+    requireMatchingRole(roleArn, target, parsedRoleArn) {
+        if (parsedRoleArn.accountId !== target.accountId ||
+            parsedRoleArn.roleName !== target.roleName) {
+            throw new Error(`Target Role ARN parts do not match Role ARN ${roleArn}`);
+        }
+    }
+}
+//# sourceMappingURL=assume-role-target-resolver.js.map

package/dist/service/sts/auth-z/resolve/assume-role-target-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"assume-role-target-resolver.js","sourceRoot":"","sources":["../../../../../src/service/sts/auth-z/resolve/assume-role-target-resolver.ts"],"names":[],"mappings":"AACA,OAAO,EACL,gBAAgB,GAEjB,MAAM,kDAAkD,CAAC;AAE1D;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,wBAAwB;IACN,aAAa;IAA1C,YAA6B,aAAa,GAAG,IAAI,gBAAgB,EAAE;6BAAtC,aAAa;IAA4B,CAAC;IAEvE;;;;;;;;;OASG;IACH,OAAO,CACL,OAAe,EACf,MAAyC;QAEzC,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAExD,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC/B,IAAI,CAAC,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC;YAC5D,OAAO,aAAa,CAAC;QACvB,CAAC;QAED,IAAI,CAAC,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC;QACzD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;OAKG;IACK,sBAAsB,CAC5B,OAAe,EACf,eAAgC,EAChC,aAA8B;QAE9B,IAAI,aAAa,CAAC,SAAS,KAAK,eAAe,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CACb,kBAAkB,eAAe,4BAA4B,OAAO,EAAE,CACvE,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,mBAAmB,CACzB,OAAe,EACf,MAAuB,EACvB,aAA8B;QAE9B,IACE,aAAa,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS;YAC5C,aAAa,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,EAC1C,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,+CAA+C,OAAO,EAAE,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;CACF"}

package/dist/service/sts/command/assume-role/assume-role.cmd.d.ts

@@ -0,0 +1,45 @@
+import type { SimResponseMetadata } from "../../../aws/metadata/response-metadata.type.js";
+/**
+ * Minimal structural sim STS AssumeRole command.
+ */
+export interface SimAssumeRoleCommand {
+    readonly input: SimAssumeRoleCommandInput;
+}
+/**
+ * Minimal structural sim STS AssumeRole input.
+ *
+ * The optional properties reflect that runtime validation remains the
+ * responsibility of the command handler.
+ */
+export interface SimAssumeRoleCommandInput {
+    readonly RoleArn?: string | undefined;
+    readonly RoleSessionName?: string | undefined;
+    readonly DurationSeconds?: number | undefined;
+    readonly ExternalId?: string | undefined;
+}
+/**
+ * Minimal structural sim STS AssumeRole output.
+ */
+export interface SimAssumeRoleCommandOutput {
+    readonly Credentials?: SimStsCredentials | undefined;
+    readonly AssumedRoleUser?: SimStsAssumedRoleUser | undefined;
+    readonly SourceIdentity?: string | undefined;
+    readonly $metadata: SimResponseMetadata;
+}
+/**
+ * Temporary credentials issued for an assumed-role session.
+ */
+export interface SimStsCredentials {
+    readonly AccessKeyId?: string | undefined;
+    readonly SecretAccessKey?: string | undefined;
+    readonly SessionToken?: string | undefined;
+    readonly Expiration?: Date | undefined;
+}
+/**
+ * Identity associated with the issued temporary credentials.
+ */
+export interface SimStsAssumedRoleUser {
+    readonly AssumedRoleId?: string | undefined;
+    readonly Arn?: string | undefined;
+}
+//# sourceMappingURL=assume-role.cmd.d.ts.map

package/dist/service/sts/command/assume-role/assume-role.cmd.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assume-role.cmd.d.ts","sourceRoot":"","sources":["../../../../../src/service/sts/command/assume-role/assume-role.cmd.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iDAAiD,CAAC;AAE3F;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,KAAK,EAAE,yBAAyB,CAAC;CAC3C;AAED;;;;;GAKG;AACH,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9C,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC1C;AAED;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,WAAW,CAAC,EAAE,iBAAiB,GAAG,SAAS,CAAC;IACrD,QAAQ,CAAC,eAAe,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;IAC7D,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAC;CACzC;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9C,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,UAAU,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC;CACxC;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC"}

package/dist/service/sts/command/assume-role/assume-role.cmd.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=assume-role.cmd.js.map

package/dist/service/sts/command/assume-role/assume-role.cmd.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"assume-role.cmd.js","sourceRoot":"","sources":["../../../../../src/service/sts/command/assume-role/assume-role.cmd.ts"],"names":[],"mappings":""}

package/dist/service/sts/command/assume-role/assume-role.handler.d.ts

@@ -0,0 +1,40 @@
+import type { CommandHandler } from "../../../../command/command-handler.js";
+import type { SimIamAccountResolver } from "../../../iam/registry/sim-iam-account-resolver.js";
+import type { SimAssumeRoleCommand, SimAssumeRoleCommandOutput } from "./assume-role.cmd.js";
+import { type BackgroundScheduler } from "../../../../util/background/background.js";
+import type { SimAwsAccountId } from "../../../aws/sim-aws-account.js";
+import type { SimAwsPrincipal } from "../../../aws/caller/sim-aws-caller.js";
+interface AssumeRoleCommandHandlerProps {
+    readonly sourceAccountId: SimAwsAccountId;
+    readonly iamResolver: SimIamAccountResolver;
+    readonly background?: BackgroundScheduler;
+}
+/**
+ * STS AssumeRoleCommand handler.
+ *
+ * Resolves the source caller and target Role, authorizes the caller's identity
+ * policies and the Role trust policy, then delegates temporary session creation
+ * and response mapping to `AssumeRoleSessionCreator`.
+ *
+ * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/sts/command/AssumeRoleCommand/
+ */
+export declare class AssumeRoleCommandHandler implements CommandHandler<SimAssumeRoleCommand, SimAssumeRoleCommandOutput> {
+    private readonly background;
+    private readonly callerResolver;
+    private readonly requestParser;
+    private readonly authorizationCoordinator;
+    private readonly sessionCreator;
+    private readonly sourceAccountId;
+    constructor(props: AssumeRoleCommandHandlerProps);
+    /**
+     * Handle an AssumeRoleCommand from the SDK.
+     *
+     * The request parser validates and normalizes SDK input before this method
+     * coordinates authorization and temporary session creation.
+     */
+    handle(cmd: SimAssumeRoleCommand, opts?: {
+        caller?: SimAwsPrincipal;
+    }): Promise<SimAssumeRoleCommandOutput>;
+}
+export {};
+//# sourceMappingURL=assume-role.handler.d.ts.map

package/dist/service/sts/command/assume-role/assume-role.handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assume-role.handler.d.ts","sourceRoot":"","sources":["../../../../../src/service/sts/command/assume-role/assume-role.handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAC7E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAC/F,OAAO,KAAK,EACV,oBAAoB,EACpB,0BAA0B,EAC3B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,KAAK,mBAAmB,EAEzB,MAAM,2CAA2C,CAAC;AACnD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAMvE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uCAAuC,CAAC;AAG7E,UAAU,6BAA6B;IACrC,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAC;IAC1C,QAAQ,CAAC,WAAW,EAAE,qBAAqB,CAAC;IAC5C,QAAQ,CAAC,UAAU,CAAC,EAAE,mBAAmB,CAAC;CAC3C;AAED;;;;;;;;GAQG;AACH,qBAAa,wBAAyB,YAAW,cAAc,CAC7D,oBAAoB,EACpB,0BAA0B,CAC3B;IACC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAsB;IACjD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA8B;IAC7D,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAuC;IACrE,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAqC;IAC9E,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAiC;IAChE,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAkB;IAElD,YAAY,KAAK,EAAE,6BAA6B,EAgB/C;IAED;;;;;OAKG;IACG,MAAM,CACV,GAAG,EAAE,oBAAoB,EACzB,IAAI,CAAC,EAAE;QACL,MAAM,CAAC,EAAE,eAAe,CAAC;KAC1B,GACA,OAAO,CAAC,0BAA0B,CAAC,CAgCrC;CACF"}

package/dist/service/sts/command/assume-role/assume-role.handler.js

@@ -0,0 +1,69 @@
+import { BackgroundTasks, } from "../../../../util/background/background.js";
+import { makeSimAwsAccountRootPrincipal } from "../../../aws/caller/sim-aws-account-root-principal.js";
+import { SimStsAssumeRoleSessionCreator } from "../../assume/sim-sts-assume-role-session-creator.js";
+import { SimStsAssumeRoleRequestParser } from "../../assume/sim-sts-assume-role-request-parser.js";
+import { SimAwsCallerResolver } from "../../../aws/caller/sim-aws-caller-resolver.js";
+import { SimIamAccessDenied } from "../../../iam/error/sim-iam.error.js";
+import { AssumeRoleAuthorizationCoordinator } from "../../auth-z/assume-role-auth-z-coordinator.js";
+/**
+ * STS AssumeRoleCommand handler.
+ *
+ * Resolves the source caller and target Role, authorizes the caller's identity
+ * policies and the Role trust policy, then delegates temporary session creation
+ * and response mapping to `AssumeRoleSessionCreator`.
+ *
+ * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/sts/command/AssumeRoleCommand/
+ */
+export class AssumeRoleCommandHandler {
+    background;
+    callerResolver = new SimAwsCallerResolver();
+    requestParser = new SimStsAssumeRoleRequestParser();
+    authorizationCoordinator;
+    sessionCreator;
+    sourceAccountId;
+    constructor(props) {
+        const { sourceAccountId, iamResolver, background = new BackgroundTasks(), } = props;
+        this.sourceAccountId = sourceAccountId;
+        this.background = background;
+        this.authorizationCoordinator = new AssumeRoleAuthorizationCoordinator({
+            sourceAccountId,
+            iamResolver,
+        });
+        this.sessionCreator = new SimStsAssumeRoleSessionCreator({
+            iamResolver,
+        });
+    }
+    /**
+     * Handle an AssumeRoleCommand from the SDK.
+     *
+     * The request parser validates and normalizes SDK input before this method
+     * coordinates authorization and temporary session creation.
+     */
+    async handle(cmd, opts) {
+        const request = this.requestParser.parse(cmd);
+        const caller = this.callerResolver.resolve(opts?.caller, makeSimAwsAccountRootPrincipal(this.sourceAccountId));
+        // Allow for potential non-deterministic sequencing of async events.
+        await this.background.sequence();
+        if (caller.principal.kind !== "arn") {
+            throw new SimIamAccessDenied({
+                principal: caller.principal,
+                action: "sts:AssumeRole",
+                resource: request.roleArn,
+            });
+        }
+        const role = await this.authorizationCoordinator.authorize({
+            roleArn: request.roleArn,
+            roleArnParts: request.roleArnParts,
+            caller: caller.principal,
+            conditionContext: request.conditionContext,
+        });
+        return this.sessionCreator.create({
+            roleArnParts: request.roleArnParts,
+            role,
+            roleSessionName: request.roleSessionName,
+            sourcePrincipal: caller.principal,
+            durationSeconds: request.durationSeconds,
+        });
+    }
+}
+//# sourceMappingURL=assume-role.handler.js.map

package/dist/service/sts/command/assume-role/assume-role.handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"assume-role.handler.js","sourceRoot":"","sources":["../../../../../src/service/sts/command/assume-role/assume-role.handler.ts"],"names":[],"mappings":"AAMA,OAAO,EAEL,eAAe,GAChB,MAAM,2CAA2C,CAAC;AAEnD,OAAO,EAAE,8BAA8B,EAAE,MAAM,uDAAuD,CAAC;AACvG,OAAO,EAAE,8BAA8B,EAAE,MAAM,qDAAqD,CAAC;AACrG,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAE,oBAAoB,EAAE,MAAM,gDAAgD,CAAC;AACtF,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAEzE,OAAO,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AAQpG;;;;;;;;GAQG;AACH,MAAM,OAAO,wBAAwB;IAIlB,UAAU,CAAsB;IAChC,cAAc,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC5C,aAAa,GAAG,IAAI,6BAA6B,EAAE,CAAC;IACpD,wBAAwB,CAAqC;IAC7D,cAAc,CAAiC;IAC/C,eAAe,CAAkB;IAElD,YAAY,KAAoC;QAC9C,MAAM,EACJ,eAAe,EACf,WAAW,EACX,UAAU,GAAG,IAAI,eAAe,EAAE,GACnC,GAAG,KAAK,CAAC;QAEV,IAAI,CAAC,eAAe,GAAG,eAAe,CAAC;QACvC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,wBAAwB,GAAG,IAAI,kCAAkC,CAAC;YACrE,eAAe;YACf,WAAW;SACZ,CAAC,CAAC;QACH,IAAI,CAAC,cAAc,GAAG,IAAI,8BAA8B,CAAC;YACvD,WAAW;SACZ,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,MAAM,CACV,GAAyB,EACzB,IAEC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,CACxC,IAAI,EAAE,MAAM,EACZ,8BAA8B,CAAC,IAAI,CAAC,eAAe,CAAC,CACrD,CAAC;QAEF,oEAAoE;QACpE,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QAEjC,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YACpC,MAAM,IAAI,kBAAkB,CAAC;gBAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,MAAM,EAAE,gBAAgB;gBACxB,QAAQ,EAAE,OAAO,CAAC,OAAO;aAC1B,CAAC,CAAC;QACL,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,SAAS,CAAC;YACzD,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,MAAM,EAAE,MAAM,CAAC,SAAS;YACxB,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;SAC3C,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC;YAChC,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,IAAI;YACJ,eAAe,EAAE,OAAO,CAAC,eAAe;YACxC,eAAe,EAAE,MAAM,CAAC,SAAS;YACjC,eAAe,EAAE,OAAO,CAAC,eAAe;SACzC,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/service/sts/sim-sts.d.ts

@@ -0,0 +1,31 @@
+import { type BackgroundScheduler } from "../../util/background/background.js";
+import type { SimIamAccountResolver } from "../iam/registry/sim-iam-account-resolver.js";
+import type { SimAssumeRoleCommand, SimAssumeRoleCommandOutput } from "./command/assume-role/assume-role.cmd.js";
+import type { SimAwsAccountRegionScope } from "../aws/sim-aws-account-region-scope.js";
+import type { SimAwsPrincipal } from "../aws/caller/sim-aws-caller.js";
+interface SimStsProps {
+    readonly accountRegionScope?: SimAwsAccountRegionScope;
+    readonly iamResolver?: SimIamAccountResolver;
+    readonly background?: BackgroundScheduler;
+}
+/**
+ * Simulated AWS Security Token Service.
+ *
+ * STS is constructed from an Account/Region scope for consistency with other
+ * simulated services. AssumeRole resolves IAM for both the source Account and
+ * the target role's Account through the simulation-wide IAM registry.
+ */
+export declare class SimSts {
+    private readonly accountRegionScope;
+    private readonly background;
+    private readonly iamResolver;
+    constructor(props?: SimStsProps);
+    /**
+     * Handle an AssumeRoleCommand from the SDK.
+     */
+    assumeRole(cmd: SimAssumeRoleCommand, opts?: {
+        caller?: SimAwsPrincipal;
+    }): Promise<SimAssumeRoleCommandOutput>;
+}
+export {};
+//# sourceMappingURL=sim-sts.d.ts.map

package/dist/service/sts/sim-sts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-sts.d.ts","sourceRoot":"","sources":["../../../src/service/sts/sim-sts.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,mBAAmB,EAEzB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,6CAA6C,CAAC;AACzF,OAAO,KAAK,EACV,oBAAoB,EACpB,0BAA0B,EAC3B,MAAM,0CAA0C,CAAC;AAGlD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wCAAwC,CAAC;AAEvF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAEvE,UAAU,WAAW;IACnB,QAAQ,CAAC,kBAAkB,CAAC,EAAE,wBAAwB,CAAC;IACvD,QAAQ,CAAC,WAAW,CAAC,EAAE,qBAAqB,CAAC;IAC7C,QAAQ,CAAC,UAAU,CAAC,EAAE,mBAAmB,CAAC;CAC3C;AAED;;;;;;GAMG;AACH,qBAAa,MAAM;IACjB,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA2B;IAC9D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAsB;IACjD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAwB;IAEpD,YAAY,KAAK,GAAE,WAAgB,EAKlC;IAED;;OAEG;IACG,UAAU,CACd,GAAG,EAAE,oBAAoB,EACzB,IAAI,CAAC,EAAE;QACL,MAAM,CAAC,EAAE,eAAe,CAAC;KAC1B,GACA,OAAO,CAAC,0BAA0B,CAAC,CAOrC;CACF"}

package/dist/service/sts/sim-sts.js

@@ -0,0 +1,34 @@
+import { BackgroundTasks, } from "../../util/background/background.js";
+import { AssumeRoleCommandHandler } from "./command/assume-role/assume-role.handler.js";
+import { SimIamRegistry } from "../iam/registry/sim-iam-registry.js";
+import { simAwsAccountRegionScopeFactory } from "../aws/sim-aws-account-region-scope.factory.js";
+/**
+ * Simulated AWS Security Token Service.
+ *
+ * STS is constructed from an Account/Region scope for consistency with other
+ * simulated services. AssumeRole resolves IAM for both the source Account and
+ * the target role's Account through the simulation-wide IAM registry.
+ */
+export class SimSts {
+    accountRegionScope;
+    background;
+    iamResolver;
+    constructor(props = {}) {
+        this.accountRegionScope =
+            props.accountRegionScope ?? simAwsAccountRegionScopeFactory.make();
+        this.iamResolver = props.iamResolver ?? new SimIamRegistry();
+        this.background = props.background ?? new BackgroundTasks();
+    }
+    /**
+     * Handle an AssumeRoleCommand from the SDK.
+     */
+    async assumeRole(cmd, opts) {
+        const handler = new AssumeRoleCommandHandler({
+            sourceAccountId: this.accountRegionScope.accountId,
+            iamResolver: this.iamResolver,
+            background: this.background,
+        });
+        return await handler.handle(cmd, opts);
+    }
+}
+//# sourceMappingURL=sim-sts.js.map

package/dist/service/sts/sim-sts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-sts.js","sourceRoot":"","sources":["../../../src/service/sts/sim-sts.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,eAAe,GAChB,MAAM,qCAAqC,CAAC;AAM7C,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,cAAc,EAAE,MAAM,qCAAqC,CAAC;AAErE,OAAO,EAAE,+BAA+B,EAAE,MAAM,gDAAgD,CAAC;AASjG;;;;;;GAMG;AACH,MAAM,OAAO,MAAM;IACA,kBAAkB,CAA2B;IAC7C,UAAU,CAAsB;IAChC,WAAW,CAAwB;IAEpD,YAAY,KAAK,GAAgB,EAAE;QACjC,IAAI,CAAC,kBAAkB;YACrB,KAAK,CAAC,kBAAkB,IAAI,+BAA+B,CAAC,IAAI,EAAE,CAAC;QACrE,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,IAAI,cAAc,EAAE,CAAC;QAC7D,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,IAAI,IAAI,eAAe,EAAE,CAAC;IAC9D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU,CACd,GAAyB,EACzB,IAEC;QAED,MAAM,OAAO,GAAG,IAAI,wBAAwB,CAAC;YAC3C,eAAe,EAAE,IAAI,CAAC,kBAAkB,CAAC,SAAS;YAClD,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC;CACF"}